Bug #80496 [Asn->Fbk]: Issue with large Kerberos tickets and Request headers

Edit report at https://bugs.php.net/bug.php?id=80496&edit=1 ID: 80496 Updated by: bukka@php.net Reported by: martin at pentagrid dot ch Summary: Issue with large Kerberos tickets and Request headers -Status: Assigned +Status: Feedback Type: Bug Package: FPM related Operating System: centos 7, 3.10.0-1160.2.2 PHP Version: Irrelevant Assigned To: bukka Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2020-12-28 19:46:55] bukka@php.net Sorry sent a bit faster than I wanted... :) I wanted to say that I would need a bit more info and some specific example with the size of variable when this happens. Try to maybe extracted to a minimal script and minimal configuration. Also do you mean that you need that env to be sent to PHP application or is it for another module in Apache? If you don't need to be sent, could you maybe use something like ProxyFCGISetEnvIf? ------------------------------------------------------------------------ [2020-12-28 19:44:10] bukka@php.net I'm afraid it's not much info to recreate your issue. I'm not really an expert on Apache ------------------------------------------------------------------------ [2020-12-08 15:14:11] martin at pentagrid dot ch Description: ------------ Hi, Setup: centos 7, 3.10.0-1160.2.2 apache: 2.4.6-97 php: 7.2.34, but also tested with php 7.0 and 7.4 Description: We are using kerberos for sso to login into our website. In some cases users can have have a lot of groups (1000+), so the kerberos ticket and also the request header is very large. If the limit of the header exceeds a not clearly defined value due to the increased size of the kerberos ticket, the user gets back a white blank page. Status code is 200 and the size of the response header is 0. This can be caused by setting the HTTP_AUTHORIZATION variable via setenvif in apache. SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 We need this variable for another application, so its necessary. We are facing this issue only when we are using php-fpm, with the internal apache php_module this issuse disappears. There are no errors in the log of apache or php-fpm, even I set it to debug or trace8. The LimitRequestFieldSize is not the problem, I already increased this value and if this was the problem the user gets a normal error message. I hope somebody as an idea, was this problem caused. Look forward to any help. Here is our config of apache and php-fpm. apache: <VirtualHost *:80> ServerName XXX RewriteEngine On RewriteRule ^(.*)$ https://XXX$1 [R=301,L] </VirtualHost> <VirtualHost *:443> ServerName XXX ServerAlias XXX ServerAdmin XXX # Let apache know we're behind a SSL reverse proxy SetEnvIf X-Forwarded-Proto "^http$" HTTPS=on # override client IP from Header with mod_remoteip RemoteIPHeader X-Forwarded-For SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1 # haproxy RemoteIPInternalProxy 10.XX.XX.XX RemoteIPTrustedProxy 10.XX.XX.XX SSLEngine on SSLProtocol -all +TLSv1.2 SSLHonorCipherOrder on SSLCompression off SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH SSLCertificateFile /etc/pki/httpd/XXX.crt SSLCertificateKeyFile /etc/pki/httpd/XXX.key DirectoryIndex index.html index.php ProxyTimeout 240 <Proxy "unix:/run/php-fpm/XXX.sock|fcgi://php-fpm"> # Note: If you configure php-fpm to use the "pm = ondemand" then use "ProxySet disablereuse=on" ProxySet disablereuse=off </Proxy> <FilesMatch \.php$> SetHandler proxy:fcgi://php-fpm </FilesMatch> DocumentRoot /var/www/html/XXX/current/public_html/ <Directory /var/www/html/XXX/current/public_html/> Options -ExecCGI +FollowSymlinks -Includes -IncludesNOEXEC -Indexes -MultiViews -SymlinksIfOwnerMatch AllowOverride All Require all granted </Directory> <Location /> SetEnvIf Request_URI ^/XXX/.*$ noauth=1 SetEnvIf Request_URI ^/XXX/.*$ noauth=1 <RequireAny> AuthType KerberosV5 AuthName "XXX" KrbMethodNegotiate On KrbMethodK5Passwd On KrbAuthoritative On KrbAuthRealms XXX KrbVerifyKDC Off KrbServiceName HTTP Krb5KeyTab /etc/httpd/conf/XXX.http.keytab KrbSaveCredentials On KrbLocalUserMapping Off require valid-user # Monitoring - Icinga2 (Master Node I) Require ip 10.XXX.XX.XXX # Monitoring - Icinga2 (Master Node II) Require ip 10.XXX.XX.XXX # Monitoring - Icinga2 (DMZ Satellite Node) Require ip 10.XXX.XX.XX # Monitoring - Lokale Checks Require ip 127.0.0.1 Require ip 10.XX.XX.XXX Require ip 10.XX.XX.XXX Require ip 10.XX.XXX.XX Require env noauth Require env REDIRECT_noauth Require valid-user </RequireAny> </Location> <IfModule mod_negotiation.c> <IfModule mod_include.c> Alias /error/ "/var/www/html/XXX/shared/config" <Directory "/var/www/html/XXX/shared/config/error/"> Options -ExecCGI +FollowSymlinks -Includes -IncludesNOEXEC -Indexes +MultiViews -SymlinksIfOwnerMatch # AllowOverride None AddOutputFilter Includes html AddHandler type-map var LanguagePriority de en es fr ForceLanguagePriority Prefer Fallback Require all granted </Directory> ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var ErrorDocument 410 /error/HTTP_GONE.html.var ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var </IfModule> </IfModule> Alias /icons/ "/var/www/html/XXX/shared/config" <Directory "/var/www/html/XXX/shared/config/icons/"> Options -ExecCGI +FollowSymlinks -Includes -IncludesNOEXEC -Indexes +MultiViews -SymlinksIfOwnerMatch AllowOverride None Require all granted </Directory> <IfModule mod_headers.c> Header set X-XSS-Protection "1; mode=block" Header set X-Content-Type-Options nosniff Header set Content-Security-Policy "script-src 'unsafe-inline' 'self' collab1-XXX https://www.googletagmanager.com https://www.google-analytics.com; connect-src 'self' https://collab1-XXX wss://collab1-XXX;" Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains" Header set Content-Security-Policy "frame-ancestors 'self' Header always edit Set-Cookie (.*) "$1; HttpOnly; Secure" Header set Referrer-Policy "strict-origin-when-cross-origin" Header always set Feature-Policy "geolocation 'none'; midi 'none'; camera 'none'; usb 'none'; magnetometer 'none'; accelerometer 'none'; vr 'none'; speaker 'none'; ambient-light-sensor 'none'; gyroscope 'none'; microphone 'none'" </IfModule> LogLevel warn ErrorLogFormat "[%{u}t] [%-m:%l] [pid %P:tid %T] %7F: %E: [client\ %a] %M% ,\ referer\ %{Referer}i" LogFormat "%h %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" combined LogFormat "%{X-Forwarded-For}i %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D" proxy SetEnvIf X-Forwarded-For "^.*\..*\..*\..*" forwarded ErrorLog /var/log/httpd/XXX-error.log CustomLog /var/log/httpd/XXX-access.log combined env=!forwarded CustomLog /var/log/httpd/XXX-access.log proxy env=forwarded </VirtualHost> php-fpm: ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ; This file is managed by ansible; manual changes are overwritten ; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; [XXX] user = apache group = apache listen = /run/php-fpm/XXX.sock listen.backlog = 511 listen.owner = apache listen.group = apache listen.mode = 0660 pm = dynamic pm.max_children = 150 pm.start_servers = 10 pm.min_spare_servers = 10 pm.max_spare_servers = 35 pm.process_idle_timeout = 10s pm.max_requests = 2500 pm.status_path = /fpm-status ping.path = /fpm-ping ping.response = pong access.format = "%R - %u %t \"%m %r\" %s" slowlog = /var/log/php-fpm/XXX-slow.log request_slowlog_timeout = 5s request_terminate_timeout = 240s catch_workers_output = no clear_env = yes security.limit_extensions = .php php_admin_value[session.save_path] = "/var/www/html/XXX/shared/session" php_admin_value[upload_tmp_dir] = "/var/www/html/XXX/shared/tmp/upload_tmp_dir" php_admin_value[soap.wsdl_cache_dir] = "/var/www/html/XXX/current/cache/wsdl_cache_dir" php_admin_value[opcache.file_cache] = "/var/www/html/XXX/current/cache/opcache_file_cache" php_admin_value[session.save_handler] = files php_admin_value[date.timezone] = Europe/Berlin php_admin_value[max_execution_time] = "180" php_admin_value[max_input_time] = "180" php_admin_flag[expose_php] = off php_admin_flag[log_errors] = on php_admin_value[error_log] = /var/log/php-fpm/XXX-php-error.log php_admin_flag[display_startup_errors] = off php_admin_flag[display_errors] = on php_admin_value[error_reporting] = E_ALL & ~E_DEPRECATED & ~E_STRICT php_admin_flag[track_errors] = off php_admin_value[memory_limit] = "512M" php_admin_value[post_max_size] = "100M" php_admin_value[upload_max_filesize] = "100M" php_admin_value[realpath_cache_size] = "64k" php_admin_value[opcache.memory_consumption] = 320 php_admin_value[opcache.max_accelerated_files] = 13000 php_admin_value[opcache.validate_timestamps] = on php_admin_value[opcache.revalidate_freq] = 30 ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=80496&edit=1